CVE-2016-4952

QEMU (aka Quick Emulator), when built with VMWARE PVSCSI paravirtual SCSI bus emulation support, allows local guest OS administrators to cause a denial of service (out-of-bounds array access) via vectors related to the (1) PVSCSI_CMD_SETUP_RINGS or (2) PVSCSI_CMD_SETUP_MSG_RING SCSI command.

Date published : 2016-09-02

https://bugzilla.redhat.com/show_bug.cgi?id=1334384

https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html